Press Release

Article 263(4) of the Treaty on the Functioning of the European Union (TFEU) provides that: “Any natural or legal person may, under the conditions laid down in the first and second paragraphs, institute proceedings (… ) against regulatory acts which directly concern them and which do not entail implementing measures”, yesterday I lodged an application with the General Court of the European Union, seeking the annulment of the Data Privacy Framework (DPF), the EU-US Data Protection Framework Adequacy Decision of July 10, 2023, taken by the Commission pursuant to Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016 “on the protection of individuals with regard to the processing of personal data and on the free movement of such data” (the GDPR)

Considering that this new matching decision infringes my rights and does not comply with either the RGPD or the EU Charter of Fundamental Rights, I have asked the Court to annul it.

It’s important to point out that I’m speaking here in a personal capacity, as a simple citizen of the Union, and not as a French MP, Law Commissioner or CNIL Commissioner.

The conclusion of an adequacy agreement on the transfer of personal data from Europeans to the United States has been an interminable soap opera for years, punctuated by appeals filed and successfully defended by Austrian lawyer Max Schrems. His association, None Of Your Business (NOYB), also points out that the recent protection framework is a copy of the Privacy Shield, whose adequacy decision was invalidated in 2020, the latter itself being a copy of the Safe Harbor, itself invalidated in October 2015 by the Court of Justice of the European Union (CJEU). A new appeal to the CJEU has already been announced.

In the long term, therefore, we’re heading for new proceedings before the CJEU and further procrastination, inevitably time-consuming, the outcome of which, even if foreseeable, will perpetuate a legal vacuum giving the dominant American players free rein to perpetuate their supremacy, to the detriment of their European counterparts, all European citizens and European sovereignty. “Time is money”, we used to say across the Atlantic, “Time is data,” we could say these days, and data is money.

The implementation of a system to protect Europeans’ personal data is therefore at a standstill, to the detriment not only of their rights, but also of European sovereignty and the economy.

The absence of any debate or vote on the DPF in the European Parliament or national parliaments, and the favorable opinion of virtually all member countries (decided on in France with total discretion), left no room for the expression of any possible contestation.

Not having had the opportunity of an informed debate as part of my political mandate, and concerned about the consequences of such a text, I have chosen a procedural route which is still unused, but which has been offered to European citizens since the Lisbon Treaty. If successful, it offers the considerable advantage of speed. The sooner the current agreement is suspended, or even annulled, the sooner it will be possible to work on finalizing a satisfactory, balanced text, which is absolutely not the case at present.

From a purely formal point of view, the DPF of July 10, 2023 violates Regulation No. 1 determining the languages to be used by the Union. Although this text came into force on that date, no version other than the English-language version appears to have been drafted and is not yet available. Article 4 of the Regulation stipulates that “regulations and other texts of general application shall be drawn up in the official languages”, while Article 3 states that “texts addressed by the institutions to a Member State (…) shall be drawn up in the language of that State”. This regrettable omission has all the hallmarks of a missed opportunity, and in itself would be worth an entire analysis.

Basically, while the negotiations were objectively made difficult by fundamentally different conceptions of the law, and more specifically of personal data protection, the arbitration was almost systematically in favor of an American-centric tropism. The result could only be a profoundly unbalanced system, built to the detriment of European law, which is more protective of personal data, and ultimately of the Union’s citizens.

The text resulting from these negotiations violates the Charter of Fundamental Rights of the Union, due to insufficient guarantees of respect for private and family life with regard to the bulk collection of personal data, and the General Data Protection Regulation (GDPR), due to the absence of guarantees of a right to an effective remedy and access to an impartial tribunal, the lack of supervision of automated decisions or lack of guarantees relating to the security of the data processed : These are just some of the violations of European law that I describe in the 33-page brief (+ 283 pages of annexes) filed with the European Court of Justice yesterday.
It is regrettable that the Commission has ignored the reservations of the European Parliament, which stressed in its resolution that “a full assessment of the implementation [of data protection principles such as necessity and proportionality] in the US legal order may be impossible due to a lack of transparency in the Data Protection Review Court (DPRC) procedures”.

As well as challenging an agreement that has clearly been drawn up to the detriment of Europe and its citizens, I hope that this application to the European Court of Justice, which is a first, will be validated, will set a precedent and will make it possible to rebalance powers within the Union, by giving every European citizen anxious to defend his or her rights the possibility of challenging decisions that are prejudicial to him or her.
I would like to thank the jurists, lawyers and experts who, in consortium, have accompanied me in this process, some officially, others on the sly. All of you will recognize yourselves! As the European Commission published the DPF in the middle of the summer recess, they agreed to sacrifice part of their vacations to collaborate on this work, for which I am all the more grateful.

Philippe Latombe

Député de Vendée

philippe.latombe@assemblee-nationale.fr

07 87 99 87 07